[Snort-users] core dump in sp_respond2.c

James Riden j.riden at ...11179...
Mon Feb 28 19:19:12 EST 2005

System is snort 2.2.0 + flexresp2 / i386 / FC3 

(gdb) where
#0  Respond2Init (data=0x8dbe460 "icmp_all", otn=0xe, protocol=17) at ../../../src/detection-plugins/sp_respond2.c:435
#1  0x08052dd0 in ParseRuleOptions (rule=0x88ecc50 "`\uffff\216\bk#\a\b", rule_type=14, protocol=17) at ../../src/parser.c:1796
#2  0x0805567a in ParseRule (rule_file=0x8917518, prule=0x8dad809 ">", inclevel=1) at ../../src/parser.c:766
#3  0x08055d7d in ParseRulesFile (
    file=0xbff1a8a0 "alert udp $HOME_NET !53 -> $EXTERNAL_NET any (msg:\"BLOCK P2P ed2k ping\"; content:\"|e396|\"; offset:0; depth:4; dsize: 6; classtype:policy-violation; reference:url,www.giac.org/practical/GCIH/Ian_Goslin"..., inclevel=1) at ../../src/parser.c:258
#4  0x080559e8 in ParseRule (rule_file=0x88f0ea8, prule=0xbff1ce40 "include $RULE_PATH/local.rules", inclevel=0) at ../../src/parser.c:529
#5  0x08055d7d in ParseRulesFile (file=0xbff1ce40 "include $RULE_PATH/local.rules", inclevel=0) at ../../src/parser.c:258
#6  0x0805996e in SnortMain (argc=14, argv=0x0) at ../../src/snort.c:486
#7  0x08059cf3 in main (argc=14, argv=0xe) at ../../src/snort.c:170
#8  0x003e2e33 in __libc_start_main () from /lib/tls/libc.so.6
#9  0x0804a461 in _start ()

Code is: sp_respond2.c:435

    if (link_offset)
        eth = (EtherHdr *)tcp_pkt;
>>>>    eth->ether_type = htons(ETH_TYPE_IP);

The rule which triggers this is apparently:

alert udp $HOME_NET !53 -> $EXTERNAL_NET any (msg:"BLOCK P2P ed2k ping"; content:"|e396|"; offset:0; depth:4; dsize: 6; classtype:policy-violation; resp:icmp_all; reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; sid:1712320; rev:1;)

Anyone seen anything like this? I've worked around it by removing the
resp:icmp_all for the moment. It's only doing it on one out of three
machines for some reason.

James Riden / j.riden at ...11179... / Systems Security Engineer
Information Technology Services, Massey University, NZ.
GPG public key available at: http://www.massey.ac.nz/~jriden/

More information about the Snort-users mailing list